| 1 | | I agree @yogeshbhutkar that this behavior seems to be expected, as labels are properly escaped for security purposes using `esc_html`. Additionally, I noticed that in plugins.php, the plugin name is sanitized using the following approach: |
| 2 | | |
| 3 | | {{{ |
| 4 | | // Sanitize fields. |
| 5 | | $allowed_tags_in_links = array( |
| 6 | | 'abbr' => array( 'title' => true ), |
| 7 | | 'acronym' => array( 'title' => true ), |
| 8 | | 'code' => true, |
| 9 | | 'em' => true, |
| 10 | | 'strong' => true, |
| 11 | | ); |
| 12 | | |
| 13 | | /* |
| 14 | | * The name is marked up inside <a> tags. These tags are not allowed. |
| 15 | | * The author field also uses markup, but some plugins include <a> tags here (omitting the Author URI). |
| 16 | | */ |
| 17 | | $plugin_data['Name'] = wp_kses( $plugin_data['Name'], $allowed_tags_in_links ); |
| 18 | | }}} |
| 19 | | |
| 20 | | Perhaps we could adopt a similar sanitization approach here as well to maintain consistency and further enhance security. Let me know your thoughts! |
| | 1 | I agree, @yogeshbhutkar, that this behavior seems expected, as labels are properly escaped for security purposes using `esc_html`. Additionally, we can sanitize the text using `wp_kses`, but this is not the recommended approach. More details on this can be found in https://core.trac.wordpress.org/ticket/62619 |
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
